CVE-2023-6151
📋 TL;DR
This vulnerability in ESKOM Computer's e-municipality module allows attackers to misuse privileged APIs to collect user-provided data. It affects all systems running e-municipality module versions before v.105. Municipal organizations using this software are primarily at risk.
💻 Affected Systems
- ESKOM Computer e-municipality module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive citizen data, manipulate municipal records, or gain unauthorized access to administrative functions.
Likely Case
Unauthorized data collection from users, potentially exposing personal information submitted through municipal services.
If Mitigated
Limited impact with proper API access controls and network segmentation in place.
🎯 Exploit Status
Requires understanding of the privileged APIs and how to misuse them. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v.105
Vendor Advisory: https://www.usom.gov.tr/bildirim/tr-23-0664
Restart Required: Yes
Instructions:
1. Download e-municipality module v.105 from ESKOM Computer. 2. Backup current installation. 3. Apply the update following vendor documentation. 4. Restart the application/service.
🔧 Temporary Workarounds
Restrict API Access
allImplement strict access controls on privileged APIs to limit exposure.
Network Segmentation
allIsolate the e-municipality module from untrusted networks.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-provided data
- Deploy web application firewall (WAF) rules to detect and block API misuse patterns
🔍 How to Verify
Check if Vulnerable:
Check the installed version of e-municipality module via administrative interface or configuration files.Check Version:
Check application configuration or vendor-provided version check utility.Verify Fix Applied:
Confirm version is v.105 or later and test privileged API access controls.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to privileged endpoints
- Unexpected data collection patterns
- Multiple failed authentication attempts to administrative APIs
Network Indicators:
- Unusual outbound data transfers from the e-municipality server
- Suspicious API request patterns
SIEM Query:
source="e-municipality" AND (event_type="api_call" AND api_endpoint CONTAINS "privileged")